Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 02:47

General

  • Target

    c4c717cf99aff48832cecaf67a52b592.exe

  • Size

    757KB

  • MD5

    c4c717cf99aff48832cecaf67a52b592

  • SHA1

    3e949b6fb9c6d67fb9dbec0ae13de1cd8291462b

  • SHA256

    b8ccdce24de3bf276a73ac3a23c23668224735f1e0af0d280868efc8fdbc51a6

  • SHA512

    f9f897b1df7c5b5514a194b078cd0e0e56af325cbf69aeb0722a02cacf03779aa031e08f7f87dbc7406e0f3094beae12ac78463c299a9062933814c1ca58e98c

  • SSDEEP

    12288:gDBqmbrCFtTZk+rgePAmdfzQ1FgflGIGTJ36k6UpkJh6H9LCqPJmRyEAbX8DzX0/:CBpWFtTi+1PAqzQ1FuGBTphW0/r8P0Tj

Malware Config

Signatures

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Nirsoft 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
    "C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
      C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3200
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:1608
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
          PID:1936
        • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
          /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4540

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1608-37-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1608-43-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1608-42-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1608-40-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1608-39-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1608-38-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/1936-53-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1936-51-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1936-57-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1936-56-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1936-54-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1936-52-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3200-28-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3200-26-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3200-29-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3200-23-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3200-24-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3200-25-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3244-5-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/3244-11-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/3244-3-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/3244-16-0x0000000000640000-0x000000000064A000-memory.dmp

      Filesize

      40KB

    • memory/3244-7-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/3244-10-0x0000000000C00000-0x0000000000C27000-memory.dmp

      Filesize

      156KB

    • memory/3244-2-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/3244-4-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/3244-20-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/3244-84-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/3244-83-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/3244-80-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/4540-68-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4540-67-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4540-66-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4540-65-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB